Chaos Computer Club, Others Scoff At German Email Security Move As "Marketing"

The move on the part of three large German ISPs to provide more secure email, marketed as "Email made in Germany" (Deutsche Telekom's part specifically was mentioned here yesterday), has drawn sharp criticism from security experts, according to a report at Ars. Among those experts are members of the Chaos Computing Club, and GPGMail lead Lukas Pitschl, who responded to the move from Deutsche Telekom, GMX, and Web.de to encrypt all email in transmission with SMTP TLS : "'If you really want to protect your e-mails from prying eyes, use OpenPGP or S/MIME on your own desktop and don't let a third-party provider have your data,' he told Ars. 'No one of the "E-Mail made in Germany" initiative would say if they encrypt the data on their servers so they don't have access to it, which they probably don't and thus the government could force them to let them access it.'"

Comments

Its a start

[maas15]

It's a start, at least the passwords are safe... there's a tendency for security communities to scoff at nearly any half improvement

Re:Its a start

[ogdenk]

1.) SMTP TLS has been around for a while.

2.) It can be used to encrypt traffic between client and server and serverserver assuming one end isn't using some 15 year old MTA or is too lazy to set up TLS.

So no, it's not a backwards step. It helps prevent sniffing e-mail traffic on the local LAN from client->server at least and most of the time serverserver. It's more like they are 15 years late doing something that should have already been done. It does NOT help with mail stored on the server so if it's hacked/siezed you're still screwed.

The biggest problem is the NSA is basically trying to render SSL/TLS useless by bullying CA's into handing over keys.

The NSA has shown us the most basic weakness with TLS/SSL recently. Really, until everyone starts using GPG or SMTP is replaced with something more modern, there is no such thing as comfortable end-to-end e-mail security.

But you're right, they shouldn't try to instill a sense of false security but that's not the same as NO security. SSL/TLS does really help and any mail provider that doesn't support it by now should be considered insane and possibly blacklisted.

Think about it though, if they came out and told the public "we're spending a bunch of money and resources to help e-mail security out a little bit so people can have a slightly smaller chance of reading your mail" they would get screamed at.

So what ever became of public key escrows?

[goombah99]

When public key encryption first came out in the late 70s, the promise was we would all have escrowed public keys. A public key would be linked to an e-mail address in the same way a DNS server connects a URL to an IP. I woul dnot need to know your public key ahead of time, my e-mail client would quietly fetch it for me using your e-mail address, and then encrypt the message.

So basically by now all e-mail should be encrypted by default if the future had panned out the way everyone thought in 1976.

All that's missing is ubiquitious public key servers and a universal protocol for binding a key to an e-mail. We do this a zillion times a day for DNS, so it's not technologically difficult.

Why didn't it happen?

Re:So what ever became of public key escrows?

[MichaelSmith]

I use the enigmail extension for thunderbird. It transparently handles the encryption and decryption of messages. It looks up PGP keys on key servers for recipients of the messages I send. I store my key on pool.sks-keyservers.net

The choice of key server is entirely up to me. It is not built into enigmail.

Re:So what ever became of public key escrows?

[goombah99]

I use the enigmail extension for thunderbird. It transparently handles the encryption and decryption of messages. It looks up PGP keys on key servers for recipients of the messages I send. I store my key on pool.sks-keyservers.net

The choice of key server is entirely up to me. It is not built into enigmail.

Cool. But this isn't really fixing the core problem of universality. If everyone uses a different key server, then I have to know what key server someone used to send them an e-mail (and vica versa). We don't have that problem with DNS. every URL gets resolved. the DNS servers push out best guess routing tables. The whole internet is transparent to the user just given the DNS and a URL. It should be that way for e-mail.

Ideally you could imagine that the DNS resolver would also resolve translation of the e-mail address to a public key. It could cache the keys itself, or know what key server to query. The problem with that idea perhaps is that there are more e-mail addresses than URLs. So what you want to do instead us have the url in the e-mail address proivide the service.

THat is, if I want to send an e-mail to foo@hotmail.com then my client query's hotmail for the public key for foo. If hotmail decided not to particiapte the DNS could provide an alternative address for a catch-all server of keys.

But I just don't see how this works if everyone is using a different service provided for their key. How can my client know what to do??